{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u0026nbsp;\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EData protection can be complicated and does require some knowledge of the subject. It is advisable that the responsibility for leading on data protection is an individual that can act as a Data Lead. Anyone acting as a Data Lead is responsible for supporting the Scout Unit they are attached to.\u003C/p\u003E\n\u003Cp\u003EThe General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018) require several specific provisions to be in place for an organisation, which consider proactive and reactive data protection practices.\u003C/p\u003E\n\u003Cp\u003ETo assist an organisation in handling the responsibility for guidance and advice, emphasis has been placed on the Data Protection Officer (DPO) role. In some cases, \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/accountability-and-governance/data-protection-officers/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office\u0022\u003Ethis role is mandated by the Information Commissioner\u2019s Office (ICO)\u003C/a\u003E. This is when the data gathered and processed is sensitive in nature (special category) and \u2018large scale\u2019. Large scale is not defined but it\u2019s implied to be more than 50% of the total data held.\u003C/p\u003E\n\u003Cp\u003EIf the requirement for a DPO does not apply, it is still advisable to align the proactive and reactive duties of the role to a Data Lead, either an internal or external resource:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EProactive\u003C/h4\u003E\n\u003Cp\u003EThe proactive duties that should align to the GDPR and DPA 2018 legislation include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EKeeping updated on data privacy legislation and any changes\u003C/li\u003E\n\u003Cli\u003EInforming the organisation and staff of updates to data privacy legislation\u003C/li\u003E\n\u003Cli\u003EAssessing risk for any significant projects/changes that may require Data Privacy Impact Assessments (DPIA) \u2013 risk assessment for any new or changed processing activity or system, a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003Etemplate has been provided\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003EA record of processing (and data inventory document)\u003C/li\u003E\n\u003Cli\u003EAny other steps to accountability\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EReactive\u003C/h4\u003E\n\u003Cp\u003E\u003Cspan\u003EThe data protection lead has a requirement to be available in a reactive capacity for situations such as:\u003C/span\u003E\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EA breach incident, where a breach has occurred and needs to be assessed, managed and reported upon, including reporting to the ICO\u003C/li\u003E\n\u003Cli\u003ESubject Rights Request (SRR), where a request has been received from a data subject to do something with the data you hold on them (disclose, delete, rectify, etc.)\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIt is advisable that the individual who takes on the role:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EBe up-to-date with the GDPR and DPA 2018\u003C/li\u003E\n\u003Cli\u003EBe able to communicate with the organisation at the highest level\u003C/li\u003E\n\u003Cli\u003EWhere possible, be independent and impartial with no conflict of interests with the organisation\u003C/li\u003E\n\u003Cli\u003EHave a good understanding of the organisation\u0027s data processing activities\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EDue to the diverse skillset throughout the volunteer structure, it is advisable to look within the local Scout Units for anybody that can fulfil this function.\u003Cbr\u003E\u0026nbsp;\u003Cbr\u003EThere is an accreditation with associated training that assists individuals in becoming a Data Lead.\u003C/p\u003E\n\u003Cp\u003EMore information about this role can be found on our \u003Ca href=\u0022/volunteers/running-things-locally/tools-to-support-leadership-teams/how-teams-share-tasks/accreditations/leadership-team-accreditations/\u0022 title=\u0022Leadership Team Accreditations\u0022\u003ELeadership Team Accreditations page\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003ERisk Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca href=\u0022/volunteers/running-things-locally/tools-to-support-leadership-teams/how-teams-share-tasks/accreditations/leadership-team-accreditations/\u0022 title=\u0022Leadership Team Accreditations\u0022\u003EMore information about the Data Lead role\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 3","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","id":47219,"nodeName":"Step 3: Appointing a Data Lead","title":"Step 3: Appointing a Data Lead","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 3: Appointing a Data Lead","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIxOSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/"}